Package
redpanda-operator-25.3
Component
go.opentelemetry.io/otel/sdk/log
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not fixed upstream: CVE-2026-81872 is fixed in go.opentelemetry.io/otel/sdk/log 0.21.0, which requires go.opentelemetry.io/otel/log 0.21.0. That otel/log release removed the Value and KeyValue types. In the Redpanda Operator 25.1 and 25.3 release lines, the operator's own OpenTelemetry logging code (pkg/otelutil/log) still uses the removed types. The newest releases on those lines, v25.1.4 and v25.3.10, have not adopted the replacement API. The newer 26.x lines depend on github.com/redpanda-data/common-go/otelutil, which has not adopted it either. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-81872 https://github.com/advisories/GHSA-hjf4-fphr-2h65 https://github.com/open-telemetry/opentelemetry-go/blob/log/v0.21.0/CHANGELOG.md https://github.com/redpanda-data/redpanda-operator/blob/operator/v25.3.10/pkg/otelutil/log/logr.go#L52
Status